Security audit
Security checks for vulnerabilities and agentic risk
This is a descriptive budgeting guidance skill that stays local and does not access accounts, make transactions, or call external services.
Install this if you want local budgeting templates and lightweight recommendations. Treat outputs as informational, avoid sharing unnecessary sensitive financial details, and use a qualified professional for tax, investment, debt, or major financial decisions.
Line L18 states 'Clear documentation in English,' which imposes a specific language requirement in natural language. The file does not provide an opt-in choice or a documented justification for restricting output/documentation to English, which matches the locale policy violation criteria.
The core description and several example sections are written in Chinese, which signals a language-specific experience, but the file does not state that the skill is intended only for Chinese-speaking users or offer any opt-in/choice of language. This can violate the language/locale policy because the skill appears generally applicable while implicitly constraining users to one language.
The trigger section includes examples like receivables aging, invoice compliance, pricing strategy, tax deductions, and financial reports, which extend well beyond personal budgeting. This can cause the agent to activate in unintended financial-adjacent contexts and produce advice outside the skill’s stated scope, increasing the chance of misleading outputs or inappropriate routing.
The module documentation says the skill is a 'Descriptive skill providing templates and frameworks,' implying generic guidance. In practice, the code parses user input for amounts, dates, debt, savings, retirement, timeframe, and priority, then generates individualized budgeting recommendations under the identity 'Personal Budget Planner,' which materially exceeds the documented intent.
The trigger list includes extremely broad terms such as "personal," "budget," and "planner," which are common in everyday conversation and likely to cause unintended invocation or routing collisions with other skills. In a finance-related skill, accidental activation can expose users to irrelevant budgeting prompts or capture sensitive financial context when the user did not intend to use this specific skill.
The file declares language: en, but later includes a Chinese scenario and expected output without explaining whether the skill supports multiple languages or adapts to the user's language. This creates an unclear language policy and may amount to forcing or assuming a locale without explicit user opt-in or documented multilingual behavior.
The manifest sets the language to "en", which can indicate a fixed language choice. There is no visible note that this is user-selectable or justified as a region-specific constraint, so it may conflict with a language or locale choice policy.
No suspicious patterns detected.
